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United States General Accounting Office 
Washington, DC 20548 



November 22, 2002 

The Honorable Tommy G. Thompson 
Secretary of Health and Human Services 

Subject: Homeland Security: CDC's Oversight of the Select Agent Program 
Dear Mr. Secretary: 

The intentional dissemination of anthrax in the U.S. mail last fall demonstrates the 
devastating effect a biological agent can have if it falls into the wrong hands. 
Exposures to anthrax-tainted mail resulted in five deaths and 17 other infections, as 
well as significant disruption to postal service and other government operations. The 
sources from which terrorists can potentially obtain biological agents include public 
and private research laboratories located in the United States, and there is concern 
that the anthrax used in these incidents may have been obtained from federal or 
other domestic laboratories. 

In the Antiterrorism and Effective Death Penalty Act of 1996, 1 the Congress included 
provisions to regulate the transfer between laboratories of certain biological agents 
and toxins — called select agents — and required the Secretary of Health and Human 
Services (HHS) to issue regulations to implement these provisions. In response, HHS 
established in 1997 the Laboratory Registration/Select Agent Transfer Program at the 
Centers for Disease Control and Prevention (CDC), which developed the current list 
of 42 select agents covered by the program. The Select Agent Program is responsible 
for regulating the transfer of select agents to limit their distribution to only those 
laboratories that have the appropriate safety and security controls for handling 
biologic agents. 2 Facilities interested in transferring — sending or receiving — select 
agents must be registered with CDC. 3 To register, facilities must demonstrate in their 
applications that they meet the conditions for safety and security and have legitimate 
research needs for the agents, and CDC may inspect facilities before and after 
registration to ensure compliance. Laboratories possessing but not transferring 
select agents are not subject to the act. 

In the wake of the anthrax incidents and mounting concerns about the potential for 
another bioterrorism attack, we have assessed CDC's oversight of the Select Agent 



'Pub. L. No. 104-132, § 511, 110 Stat. 1214, 1284-1285 (1996). 

2 CDC oversees the domestic transfer and possession of select agents. The Commerce Department's 
Bureau of Export Administration oversees a separate select agent export program for transfers outside 
the United States. 

J CDC's own laboratories that transfer select agents must also register with the program and are subject 
to its requirements. 
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Program. We brought program weaknesses we identified to the immediate attention 
of CDC and HHS officials, who agreed that improvements were warranted. The 
purpose of this report is to summarize our findings and confirm your agreement to 
take prompt corrective action. 

In conducting our work, we evaluated the Select Agent Program's operations by 
applying the criteria in the Office of Management and Budget's (OMB) Circular A-123, 
Management Accountability and Control 4 and in our Internal Control: Standards 
for Internal Control in the Federal Government, 5 which lays out five standards of 
internal control. These five standards — control environment, risk assessment, 
control activities, information and communication, and monitoring 6 — define the 
minimum level of quality acceptable for internal control in government. We also 
reviewed the registration applications for a nongeneralizable 10 percent random 
sample of Select Agent Program registrants and those registrants' transfer forms, 
which are required for transferring select agents; all CDC laboratory inspection 
reports; information in CDC's database on registered facilities and select agent 
transfers; and Select Agent Program policies and procedures. We interviewed 
program and management staff in CDC's Select Agent Program in Atlanta, Ga, and in 
HHS. Additionally, we reviewed the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002. Our review was limited to CDC's 
management of the Select Agent Program and does not include the actual shipments 
of select agents or the safety and security of registered facilities. In addition, 
consistent with the scope of the Select Agent Program, we did not assess the merits 
of the research conducted by program registrants. We conducted our review from 
November 2001 through September 2002 in accordance with generally accepted 
government auditing standards. 

Results in Brief 

As the agency responsible for identifying and controlling biological agents that have 
the potential to pose a severe threat to public health and safety, CDC can improve its 
management of the Select Agent Program to reduce the likelihood of unauthorized 
access to biological agents. During the course of our review, we identified and 
brought to the immediate attention of CDC and HHS officials areas in which program 
oversight could be strengthened, including inspection and approval of facilities and 
monitoring of the transfer and shipment of select agents. To better position CDC to 
reasonably ensure that appropriate security and safety protections are in place for 
select agents, we made recommendations aimed at establishing proper internal 



4 Office of Management and Budget, OMB Circular A-123, Management Accountability and Control, 
(Washington, D.C.: 1995). This document provides the specific requirements for assessing and 
reporting on controls. 

°U.S. General Accounting Office, Internal Control: Standards for Internal Control in the Federal 
Government, GAO/AIMD-00-2 1.3.1 (Washington, D.C.: November 1999). The Federal Managers' 
Financial Integrity Act of 1982 (FMFIA) requires us to issue standards for internal control in 
government. Among other things, the standards provide the overall framework for establishing and 
maintaining internal control. 

'See the enclosure of this report for a more detailed discussion of internal controls. 
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control in accordance with OMB Circular A-123 over the Select Agent Program. In 
discussing these recommendations with CDC officials, they concurred and noted 
improvements planned or already in progress. 

Background 

Biological agents pose a severe public health threat in our country if individuals or 
groups intent on harming the United States are able to obtain them. To better ensure 
the safe transfer of select agents, the Antiterrorism and Effective Death Penalty Act 
of 1996 required the Secretary of HHS to 

• provide for safeguards to prevent access to such agents for use in domestic 
or international terrorism or for other criminal purposes; 

• provide for the establishment and enforcement of safety procedures for the 
transfer of the listed biological agents, including measures to ensure proper 
training and appropriate skills to handle agents and proper laboratory 
facilities to contain and dispose of agents; 

• establish and maintain a list of biological agents that have the potential to 
pose a severe threat to public health and safety; and 

• provide for the establishment of procedures to protect the public safety in 
the event of an actual or potential illegal transfer of a biological agent. 

HHS established the Select Agent Program within the Office of External Activities 
under the Office of Health and Safety at CDC. Program funding has increased 
substantially since the program was established in 1997. Funding for fiscal year 2002 
was originally $1 million. As a result of Public Law 107-117, enacted on January 10, 
2002, an additional $3.6 million was made available to the program for fiscal year 
2002. The program was authorized to fund 21 staff in fiscal year 2002 — up from 9 in 
fiscal year 2001. 

The regulations governing the Select Agent Program became effective on April 15, 
1997. 7 The regulations include six primary components: (1) a list of select agents that 
have the potential to pose a severe threat to public health and safety, 8 (2) registration 
of facilities prior to the domestic transfer of select agents, (3) a process to document 
successful transfer of agents, (4) audit, quality control, and accountability 
mechanisms, (5) agent disposal requirements, and (6) research and clinical 
exemptions. 9 

To limit the distribution of select agents to laboratories with appropriate safety and 
security controls for handling biologic agents and a legitimate need for such agents, 



The regulations are set forth at 42 C.F.R. Part 72 (2002). 

8 CDC's select agent list consists of 42 viruses, bacteria, rickettsiae, fungi, and toxins. CDC worked 
with representatives of several countries, U.S. intelligence officials, and safety professionals to 
establish its list based on a list of biological agents for export control developed by the Australia 
Group — an informal network of 33 countries that aims to minimize the proliferation of chemical and 
biological weapons. 

"For example, vaccines at certain stages of clinical research and clinical specimens are exempt. 
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CDC requires U.S.-based research institutions, government agencies, universities, 
manufacturers, and other entities interested in transferring select agents to be 
registered. 10 Registration is for 3 years. As part of the registration process, facilities 
must demonstrate in their applications that they meet the requirements delineated in 
Biosafety in Microbiological and Biomedical Laboratories (BMBL) 11 for working 
with particular select agents. Such requirements include having proper laboratory 
and personal protective equipment, precautionary signage, and ventilation; controlled 
access; and biosafety operations manuals. Facilities must also describe the 
laboratory procedures that will be used, provide a laboratory floor plan where the 
select agent will be handled and stored, and describe how access will be limited to 
authorized personnel. In addition, facilities must describe the objectives of the work 
that requires the select agent. Each facility must identify a responsible facility official 
who is authorized to transfer and receive select agents on behalf of the facility. 
Individuals making false, fictitious, or fraudulent statements or representations on 
registration forms may be punished by a fine of up to $250,000, imprisonment up to 5 
years, or both. Violations by organizations are punishable by a fine of up to $500,000 
per violation. 12 To ensure compliance with these requirements, the program 
established a goal of inspecting these facilities once during the 3-year registration 
period. Facilities may be inspected before and after registration, but there is no 
requirement that inspections be performed. 

In June 2002, the President signed into law the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002, which revises and expands the 
Select Agent Program. 13 Among other requirements, the new law 

• requires all facilities possessing select agents to register with the Secretary 
of HHS, not just those facilities sending or receiving select agents; 14 

• restricts access to biological agents and toxins by persons who do not have 
a legitimate need and who are considered a risk by federal law 
enforcement and intelligence officials; 



There are a number of circumstances under which a facility might want to send or receive a select 
agent. For example, some facilities have select agents that other facilities would need to conduct 
research, such as vaccine development. 

"U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control 
and Prevention and National Institutes of Health, Biosafety in Microbiological and Biomedical 
Laboratories, Fourth Edition (Washington, D.C.: May 1999). 
12 42 C.F.R. § 72.7. 

13 Pub. L. No. 107-188, 116 Stat. 594, 637-647. 

"The law required all persons possessing select agents to register with HHS by September 10, 2002, 
and HHS issued guidance for how the notification of possession should be made in July 2002. 67 Fed. 
Reg. 46,363 (2002). The department must promulgate regulations for the select agent program by 
December 9, 2002, to implement other requirements of the law. 
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• requires transfer registrations to include information regarding the 
characterization of agents and toxins to facilitate their identification, 
including their source; 15 

• requires the creation of a national database with information on all 
facilities and persons possessing, using, or transferring select agents; 

• directs the Secretary of HHS to review and publish the select agent list 
biennially, making revisions as appropriate to protect the public; and 

• requires the Secretary to impose more detailed and different levels of 
security for different select agents based on their assessed level of threat to 
the public. 

Select Agent Program staff estimate that this new law could result in a tenfold 
expansion of their responsibilities because many more facilities possess select agents 
than those registered to transfer them so far. 

CDC Needs to Improve Internal Control Weaknesses 
to Better Manage the Select Agent Program 

We found significant management weaknesses in CDC's facility registration and 
transfer monitoring processes that impede effective program oversight. As discussed 
with CDC officials, we recommended that CDC establish proper internal control in 
accordance with OMB Circular A-123. This would include improvements in the 
following areas: 

• inspection and approval of facilities registering to transfer select agents, 

• monitoring of the transfer and shipment of select agents, 

• accuracy of CDC databases of registered facilities and select agent 
transfers, and 

• CDC organizational structure to improve oversight. 

HHS agreed with the need for these corrective actions and stated that improvements 
were already underway in some areas. Correcting these internal control weaknesses 
is essential to CDC's ability to effectively oversee both the original and the expanded 
program required by the Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002. Because of the urgent and potentially serious public health 



15 According to the Conference Report accompanying the law, one purpose of the registration and 
database requirements is to collect sufficiently detailed information on the registered select agents so 
that the database can differentiate between and within strains of a given agent or toxin. Such 
information should be in a format that public health and law enforcement officials can use to identify 
the origin or source of an agent that is used to cause harm to the public. H.R. Conf. Rep. No. 107-481, 
at 121 (2002). 
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threat in our country if corrective action is not taken expeditiously, we will be 
conducting periodic work to follow up on your progress in implementing our 
recommendations. 



We are sending copies of this report to the Senate Committees on Appropriations; 
Governmental Affairs; and Health, Education, Labor, and Pensions; and the House 
Committees on Appropriations; Energy and Commerce; and Government Reform. We 
will also make copies available to others on request. In addition, the report will be 
available at no charge on GAO's Web site at http ://www. gao . gov . If you or your staff 
have any questions, please contact me at (202) 512-7101. 

Sincerely yours, 




Cynthia A. Bascetta 
Director, Health Care 



Enclosure 
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INTERNAL CONTROLS 

Owe Internal Control: Standards for Internal Control in the Federal Government 16 
lays out the standards for internal control. Internal control is an integral part of a 
government organization's management that provides reasonable assurance that the 
following four objectives are being achieved: 

• operations are effective and efficient; 

• financial and other reporting is reliable; 

• applicable laws and regulations are complied with; and 

• unauthorized acquisition, use, or disposition of an agency's assets is 
prevented or detected. 

To achieve these four objectives, agencies should meet five standards for internal 
control in the federal government. Agencies should 

• have an effective control environment, 

• conduct risk assessments, 

• implement control activities, 

• properly record information and communicate to management, and 

• ensure monitoring. 

A brief explanation of each of the five standards for internal control follows. 
Control Environment 

Management and employees should establish and maintain an environment 
throughout the organization that sets a positive and supportive attitude toward 
internal control and conscientious management. 

Risk Assessments 

Agencies should provide for an assessment of risk the agency faces from both 
internal and external sources in accomplishing its mission. 

Control Activities 

Agencies should establish and carry out specific control activities — policies, 
procedures, techniques, and mechanisms — that enforce management's directives to 
help ensure that actions are taken to address risks and to document critical events 
and transactions. 



TJ.S. General Accounting Office, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 



GAO-03-315R CDC's Select Agent Program 



Enclosure 



Enclosure 



Information and Communication Channels 

Information should be recorded and communicated to management and others within 
the entity who need it and in a form and within a time frame that enable them to carry 
out their internal control and other responsibilities. 

Monitoring 

Internal control monitoring should assess the quality of performance over time and 
ensure that the findings of audits and other reviews are promptly resolved. 



(290250) 
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